CVE-2026-63587
SMS Password Authorization Bypass via Failed Attempt Counter
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliberately trigger this by submitting 5 or more invalid passwords, after which subsequent SMS commands are executed without requiring a password, resulting in potential limited configuration tampering, limited information leakage and potentially full loss of availability.
| CWE | CWE-288 |
| Vendor | weidmueller interface |
| Product | ie-sr-2tx-wl-4g-eu |
| Published | Aug 25, 2026 |
| Last Updated | Aug 27, 2026 |
Get instant alerts for weidmueller interface ie-sr-2tx-wl-4g-eu
Be the first to know when new high vulnerabilities affecting weidmueller interface ie-sr-2tx-wl-4g-eu are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H